Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
Ipswitch WS_FTP Home/Professional FTP Client - Remote Format String (PoC)
CVE-2008-3734—doswindows
Format string vulnerability in Ipswitch WS_FTP Home 2007.0.0.2 and WS_FTP Professional 2007.1.0.0 allows remote FTP serv
28RISK
open ↗
Referência✓ VexDay Proof
Acoustica MP3 CD Burner 4.32 - Local Buffer Overflow (PoC)
CVE-2007-3006—doswindows
Buffer overflow in Acoustica MP3 CD Burner 4.32 allows user-assisted remote attackers to execute arbitrary code via a .a
23RISK
open ↗
Referência✓ VexDay Proof
OtsTurntables 1.00 - '.m3u' Local Buffer Overflow
CVE-2007-4734—localwindows
Buffer overflow in Ots Labs OTSTurntables 1.00 allows user-assisted remote attackers to execute arbitrary code via a lon
23RISK
open ↗
Referência✓ VexDay Proof
LimeSurvey (phpsurveyor) 1.49rc2 - Remote File Inclusion
CVE-2007-3632—webappsphp
Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to exe
35RISK
open ↗
Referência✓ VexDay Proof
EasyNews 40tr - SQL Injection / Cross-Site Scripting / Local File Inclusion
CVE-2008-1651—webappsphp
Directory traversal vulnerability in admin/login.php in EasyNews 4.0 allows remote attackers to include and execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
gapicms 9.0.2 - 'dirDepth' Remote File Inclusion
CVE-2008-3183—webappsphp
PHP remote file inclusion vulnerability in ktmlpro/includes/ktedit/toolbar.php in gapicms 9.0.2 allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
HIOX Random Ad 1.3 - Remote File Inclusion
CVE-2008-3401—webappsphp
PHP remote file inclusion vulnerability in hioxRandomAd.php in HIOX Random Ad (HRA) 1.3 allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
PHPMesFilms 1.0 - 'index.php?id' SQL Injection
CVE-2009-0598—webappsphp
SQL injection vulnerability in index.php in PhpMesFilms 1.0 and 1.8 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
STWC-Counter 3.4.0 - 'downloadcounter.php' Remote File Inclusion
CVE-2007-1233—webappsphp
PHP remote file inclusion vulnerability in downloadcounter.php in STWC-Counter 3.4.0.0 and earlier allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
Hex Workshop 6.0 - '.hex' Local Code Execution
CVE-2009-0812—localwindows
Stack-based buffer overflow in BreakPoint Software Hex Workshop 4.23, 6.0.1.4603, and other 6.x and earlier versions all
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows XP/2003 - IGMP v3 Denial of Service (MS06-007) (1)
CVE-2006-0021—doswindows
Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang)
35RISK
open ↗
Referência✓ VexDay Proof
FreeBSD 7.0/7.1 - 'ktimer' Local Privilege Escalation
CVE-2009-1041—localfreebsd
The ktimer feature (sys/kern/kern_time.c) in FreeBSD 7.0, 7.1, and 7.2 allows local users to overwrite arbitrary kernel
23RISK
open ↗
Referência✓ VexDay Proof
The Bible Portal Project 2.12 - 'destination' File Inclusion
CVE-2006-3177—webappsphp
PHP remote file inclusion vulnerability in Admin/rtf_parser.php in The Bible Portal Project 2.12 and earlier allows remo
23RISK
open ↗
Referência✓ VexDay Proof
PNPHPBB2 < 1.2i - 'ModName' Multiple Local File Inclusions
CVE-2009-0592—webappsphp
Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute
35RISK
open ↗
Referência✓ VexDay Proof
MyABraCaDaWeb 1.0.3 - 'base' Remote File Inclusion
CVE-2006-4719—webappsphp
Multiple PHP remote file inclusion vulnerabilities in MyABraCaDaWeb 1.0.3, when register_globals is enabled, allow remot
23RISK
open ↗
Referência✓ VexDay Proof
mxCamArchive 2.2 - Bypass Configuration Download
CVE-2008-6956—webappsphp
Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to
23RISK
open ↗
Referência✓ VexDay Proof
Racer 0.5.3 Beta 5 - Remote Buffer Overflow
CVE-2007-4370—remotewindows
Multiple buffer overflows in the (1) client and (2) server in Racer 0.5.3 beta 5 allow remote attackers to execute arbit
50RISK
open ↗
Referência✓ VexDay Proof
WebXell Editor 0.1.3 - Arbitrary File Upload
CVE-2008-3178—webappsphp
Unrestricted file upload vulnerability in upload_pictures.php in WebXell Editor 0.1.3 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
ParsaWeb CMS - 'Search' SQL Injection
CVE-2008-4364—webappsasp
SQL injection vulnerability in default.aspx in ParsaGostar ParsaWeb CMS allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Scriptsez Easy Image Downloader - Local File Download
CVE-2008-6089—webappsphp
Directory traversal vulnerability in main.php in ScriptsEz Easy Image Downloader allows remote attackers to read arbitra
23RISK
open ↗
Referência✓ VexDay Proof
PAPOO 3_RC3 - SQL Injection / Admin Credentials Disclosure
CVE-2006-3571—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in interna/hilfe.php in Papoo 3 RC3 and earlier allow remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
phpMyAdmin - '/scripts/setup.php' PHP Code Injection
CVE-2009-1151CRITICALunder attackwebappsphp
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remo
100RISK
open ↗
Referência✓ VexDay Proof
dBpowerAMP Audio Player 2 - '.m3u' Buffer Overflow (PoC)
CVE-2008-0661—doswindows
Buffer overflow in dBpowerAMP Audio Player Release 2 allows remote attackers to execute arbitrary code via a .M3U file w
23RISK
open ↗
Referência✓ VexDay Proof
PHP 5.x COM - Safe Mode / disable_functions Bypass
CVE-2007-5653—localwindows
The Component Object Model (COM) functions in PHP 5.x on Windows do not follow safe_mode and disable_functions restricti
23RISK
open ↗
Referência✓ VexDay Proof
Lizardware CMS 0.6.0 - Blind SQL Injection
CVE-2008-6787—webappsphp
SQL injection vulnerability in administrator/index.php in Lizardware CMS 0.6.0 and earlier allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Pub Site - SQL Injection
CVE-2008-6794—webappsphp
SQL injection vulnerability in directory.php in Scripts For Sites (SFS) EZ Pub Site allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
Blue Eye CMS 1.0.0 - Remote Cookie SQL Injection
CVE-2009-0883—webappsphp
SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magic_quotes_gpc is disabled, allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
Acc Statistics 1.1 - Insecure Cookie Handling
CVE-2008-6294—webappsphp
admin/Index.php in Acc Statistics 1.1 allows remote attackers to bypass authentication and gain administrative access by
23RISK
open ↗
Referência✓ VexDay Proof
phpGreetCards - Cross-Site Scripting / Arbitrary File Upload
CVE-2008-6848—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência✓ VexDay Proof
CafeEngine - 'catid' SQL Injection
CVE-2009-0574—webappsphp
SQL injection vulnerability in index.php in Easy CafeEngine allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
← previouspage 820 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.